CVE-2022-2374

🗓️ 29 Aug 2022 17:15:36Reported by WPScanType

cve🔗 web.nvd.nist.gov📰️ 4 Media mentions👁 64 Views🌐 WEB

The Simply Schedule Appointments WordPress plugin before 1.5.7.7 allows stored cross-site scripting attacks

Reporter	Title	Published	Views	Family All 13
ATTACKERKB	CVE-2022-2374	29 Aug 202218:15	–	attackerkb
Circl	CVE-2022-2374	29 Aug 202222:34	–	circl
CNNVD	WordPress plugin Simply Schedule Appointments 跨站脚本漏洞	29 Aug 202200:00	–	cnnvd
Cvelist	CVE-2022-2374 Simply Schedule Appointments < 1.5.7.7 - Admin+ Stored Cross-Site Scripting	29 Aug 202217:15	–	cvelist
EUVD	EUVD-2022-34641	3 Oct 202520:07	–	euvd
NVD	CVE-2022-2374	29 Aug 202218:15	–	nvd
OSV	CVE-2022-2374	29 Aug 202218:15	–	osv
Patchstack	WordPress Simply Schedule Appointments plugin <= 1.5.7.6 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability	8 Aug 202200:00	–	patchstack
Prion	Cross site scripting	29 Aug 202218:15	–	prion
Positive Technologies	PT-2022-16242 · WordPress · Simply Schedule Appointments	29 Aug 202200:00	–	ptsecurity

NVD

Vulners

Node

nsqua simply_schedule_appointmentsRange<1.5.7.7wordpress

[
  {
    "product": "Simply Schedule Appointments – WordPress Booking Plugin",
    "vendor": "Unknown",
    "versions": [
      {
        "lessThan": "1.5.7.7",
        "status": "affected",
        "version": "1.5.7.7",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
wpscan	www.wpscan.com/vulnerability/12062d78-7a0d-4dc1-9bd6-6c54aa6bc761

Parameter	Position	Path	Description	CWE
CUSTOM CSS	request body	/wp-admin/admin.php?page=simply-schedule-appointments%2F#/ssa/settings/styles	Stored XSS in Simply Schedule Appointments plugin via unsanitized settings in CUSTOM CSS field; payload triggers script when pages/posts render shortcode.	CWE-79

17 Jun 2026 04:41Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.14.8

EPSS0.00538

CWE-79